|
| 1 | +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Cheng Zhao <zcbenz@gmail.com> |
| 3 | +Date: Wed, 23 Oct 2019 12:54:32 -0700 |
| 4 | +Subject: fix: make PDFium JS host object have immutable prototypes |
| 5 | + |
| 6 | +[1091404] [High] [CVE-2020-6513]: Google Chrome PDFium Javascript Active Document Memory Corruption Vulnerability - TALOS-2020-1092 |
| 7 | +Backport https://pdfium.googlesource.com/pdfium.git/+/bee2261eab794536f236013fa8c9d01728ed326b. |
| 8 | + |
| 9 | +diff --git a/fxjs/cfxjs_engine.cpp b/fxjs/cfxjs_engine.cpp |
| 10 | +index c4d46a29f694c2346de6a9bcde619a5281bd5136..485f7c91a794b951f40956d2c425eb3f65005a5a 100644 |
| 11 | +--- a/fxjs/cfxjs_engine.cpp |
| 12 | ++++ b/fxjs/cfxjs_engine.cpp |
| 13 | +@@ -144,6 +144,7 @@ class CFXJS_ObjDefinition { |
| 14 | + v8::HandleScope handle_scope(isolate); |
| 15 | + v8::Local<v8::FunctionTemplate> fun = v8::FunctionTemplate::New(isolate); |
| 16 | + fun->InstanceTemplate()->SetInternalFieldCount(2); |
| 17 | ++ fun->InstanceTemplate()->SetImmutableProto(); |
| 18 | + fun->SetCallHandler(CallHandler, v8::Number::New(isolate, eObjType)); |
| 19 | + if (eObjType == FXJSOBJTYPE_GLOBAL) { |
| 20 | + fun->InstanceTemplate()->Set( |
| 21 | +diff --git a/testing/resources/javascript/immutable_proto.in b/testing/resources/javascript/immutable_proto.in |
| 22 | +new file mode 100644 |
| 23 | +index 0000000000000000000000000000000000000000..61885c53758167cae5af47f8736014dcb0933aaf |
| 24 | +--- /dev/null |
| 25 | ++++ b/testing/resources/javascript/immutable_proto.in |
| 26 | +@@ -0,0 +1,43 @@ |
| 27 | ++{{header}} |
| 28 | ++{{object 1 0}} << |
| 29 | ++ /Type /Catalog |
| 30 | ++ /Pages 2 0 R |
| 31 | ++ /OpenAction 10 0 R |
| 32 | ++>> |
| 33 | ++endobj |
| 34 | ++{{object 2 0}} << |
| 35 | ++ /Type /Pages |
| 36 | ++ /Count 1 |
| 37 | ++ /Kids [ |
| 38 | ++ 3 0 R |
| 39 | ++ ] |
| 40 | ++>> |
| 41 | ++endobj |
| 42 | ++{{object 3 0}} << |
| 43 | ++ /Type /Page |
| 44 | ++ /Parent 2 0 R |
| 45 | ++ /MediaBox [0 0 612 792] |
| 46 | ++>> |
| 47 | ++endobj |
| 48 | ++% OpenAction action |
| 49 | ++{{object 10 0}} << |
| 50 | ++ /Type /Action |
| 51 | ++ /S /JavaScript |
| 52 | ++ /JS 11 0 R |
| 53 | ++>> |
| 54 | ++endobj |
| 55 | ++{{object 11 0}} << |
| 56 | ++ {{streamlen}} |
| 57 | ++>> |
| 58 | ++stream |
| 59 | ++{{include expect.js}} |
| 60 | ++expect("this.__proto__", "[object Object]"); |
| 61 | ++expect("app.__proto__", "[object Object]"); |
| 62 | ++expectError("this.__proto__ = {}"); |
| 63 | ++expectError("app.__proto__ = this"); |
| 64 | ++endstream |
| 65 | ++endobj |
| 66 | ++{{xref}} |
| 67 | ++{{trailer}} |
| 68 | ++{{startxref}} |
| 69 | ++%%EOF |
| 70 | +diff --git a/testing/resources/javascript/immutable_proto_expected.txt b/testing/resources/javascript/immutable_proto_expected.txt |
| 71 | +new file mode 100644 |
| 72 | +index 0000000000000000000000000000000000000000..7e7c6701e39592ec130ae52fc98f8af903b3152b |
| 73 | +--- /dev/null |
| 74 | ++++ b/testing/resources/javascript/immutable_proto_expected.txt |
| 75 | +@@ -0,0 +1,4 @@ |
| 76 | ++Alert: PASS: this.__proto__ = [object Object] |
| 77 | ++Alert: PASS: app.__proto__ = [object Object] |
| 78 | ++Alert: PASS: this.__proto__ = {} threw TypeError: Immutable prototype object '[object global]' cannot have their prototype set |
| 79 | ++Alert: PASS: app.__proto__ = this threw TypeError: Immutable prototype object '[object Object]' cannot have their prototype set |
0 commit comments